Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

161–170 of 360 posts

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#161

Post by saagarjha »

MayeulC wrote: post #159
saagarjha wrote: post #143

Earlier quoted context omitted.

ROP chains are similar in spirit but typically created by hand and thus not all that long (several dozen steps, at most). Creating a 70,000 step program via a Turing tarpit is very interesting.

> 70,000 step program My initial assumption was that they would compile a program, take the binary output as an image and JBIG2-compress it, as I don't really get how they would use the result of the binary operations to branch to different code. Reading the article a bit more, I think they can loop multiple times over the area, by changing w , h and line dynamically over each pass, which would give them some kind of…

iOS does not allow the modification or generation of new executable code (at least, it will not at this stage of an exploit). So they are likely creating a weird machine to patch various data and then redirecting control flow with the altered state by overwriting a function pointer.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#162

Post by TechBro8615 »

toxik wrote: post #77
moyix wrote: post #45

Earlier quoted context omitted.

No, it just means that they've found vulnerabilities that can be triggered without user interaction. This is entirely doable by just fuzzing or reverse engineering the released iOS binaries.

I mean, you’re not going to fuzz your way to bit twiddling together a small virtual computer inside of a compression stream.

The blog says the PDF parsing was based on xpdf which is open source.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#164

Post by Closi »

wolf550e wrote: post #121
shmatt wrote: post #109

NSO get way too much credit/dramatization these days. They are mostly 2 things * a shiny UI for customers * a bank of 0-days Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased. Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres real…

The researcher that leaves the military takes with them general skills in reverse engineering and exploit development, but they cannot use specific 0days they know about from their military service. The specifics of everything done in the military is classified. People told me they couldn't mention in job interviews some of the skills they have because it's a secret. Like, if someone developed this Turing complete ar…

> They cannot use specific 0days they know about from their military service

Of course they can, it is just illegal and might be classed as treason or similar.

Remember we are talking about getting exploits for nation states here rather than just some regular company - hiring spies is part of standard operations for the intelligence community and would be a valid zero-day acquisition strategy (depending on the protection offered for NSO by Israel).

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#165

Post by pizza »

danaris wrote: post #106
vmception wrote: post #58

Earlier quoted context omitted.

Enhancing works with trained AI these days Maybe not for evidence collection, but for pleasing a human being to go follow a lead sure

I've seen some examples of this. It's very clearly trained on a white-male dataset. I've also seen it "enhance" an image of a resistor into a human face. I don't care how much AI you have, you can't add back data that wasn't in the original image. The best you can hope to do is get a vague approximation, and you must have a very, very good (comprehensive) training dataset for that to be remotely viable.

The premise of the technology is not adding more information to the image. But rather realizing that the image may have a description that is a lot smaller than its file size suggests; then it becomes a matter of rendering it using world-aware encodings. The resolution may appear higher but it is actually a filtration of the original data. And there’s nothing to say that simply because the current technology is overfitted to their present-day datasets, that such a filter (that is actually useful for common images, or enhancement by leveraging known/ few-shot other examples consisting of the same target object) cannot exist.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#166

Post by onphonenow »

saagarjha wrote: post #161
MayeulC wrote: post #159

Earlier quoted context omitted.

> 70,000 step program My initial assumption was that they would compile a program, take the binary output as an image and JBIG2-compress it, as I don't really get how they would use the result of the binary operations to branch to different code. Reading the article a bit more, I think they can loop multiple times over the area, by changing w , h and line dynamically over each pass, which would give them some kind of…

iOS does not allow the modification or generation of new executable code (at least, it will not at this stage of an exploit). So they are likely creating a weird machine to patch various data and then redirecting control flow with the altered state by overwriting a function pointer.

Right, and they get there of a decomp pass on totally untrusted input over the network. This is why it's so crazy that apple has this huge attack surface.

My own suggestion. Ascii only messages if contact is not in address book or is a contact you've communicated with in your message history (however long you keep that) up to 1 year. Once you reply these untrusted saudi contacts can send you the gif meme's.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#167

Post by mtoner23 »

dreamcompiler wrote: post #160

This is quite clever, but fundamentally it's only possible because of a buffer overflow. If the JBIG decoder had been written in Rust (just to cite one example of a language safer than C), this would have been impossible. Use dumb languages, pwn valuable prizes.

lmfao of course theres a "use rust" comment on hacker news

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#168

Post by cronix »

oh_sigh wrote: post #115
cronix wrote: post #62

Earlier quoted context omitted.

It came out in the recent trial that the FBI couldn't open Kyle Rittenhouse's iPhone, which was the latest generation at that time last year.

That might just be what the FBI wants you to think...

Of course that is possible, but they also released their aerial infrared video of the event to the prosecution, which was not previously known.

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#169

Post by jaywalk »

chockablock wrote: post #158
teh_infallible wrote: post #103

Earlier quoted context omitted.

I have suspected for awhile now that the bitcoin blockchain is actually an attempt to break SHA-256. Bitcoin is built around incentives, and it has created an incentive for people all over the world to basically brute force this algorithm and maintain a recursive set of low entropy outputs. Which would make the btc blockchain an incredibly expensive and valuable data set, for someone armed with the right mathematical…

How could you break it without destroying its value?

Why would the NSA care about destroying Bitcoin's value?

Re: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

#170

Post by Etheryte »

malshe wrote: post #52

From the top of the article: > We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. This reminded me that NSO went after Citizen Lab on multiple fronts. They even tried to use a spy to talk to JSR ( https://www.johnscottrailton.com ) and make him say controversial things…

The transcript is such an intriguing read. You don't expect these things to happen in real life, but yet here they are, tie-cameras, pen recorders, driving circles around the block and all.
Post reply on HN